ClawHub
Back to skill

Security audit

Elderly Medication Compliance (Pick-up / To-mouth / Swallow) | 老年人服药动作确认（取药/入口/吞咽）

Security checks across malware telemetry and agentic risk

Overview

This skill is for medication-compliance video analysis, but it silently creates or reuses an account identity, uploads sensitive home medication footage to remote services, and stores service tokens locally.

Review before installing. This skill processes private home medication videos through external services, may retrieve historical health-related reports from the cloud, silently creates or reuses an identity, and stores returned tokens in the workspace data directory. Install only if users understand and consent to those data flows and the publisher provides acceptable privacy, retention, authorization, and deletion controls.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (26)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
78% confidence
Finding
This getattr(self.__model__, key) uses keys from the caller-supplied filters dictionary, allowing unvalidated dynamic selection of model attributes. While SQLAlchemy prevents classic SQL injection here, an attacker who can control filter keys may trigger unauthorized querying on sensitive columns, bypass expected business restrictions, or cause exceptions/denial of service by referencing unexpected attributes.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
78% confidence
Finding
The count() method repeats the same unvalidated dynamic attribute lookup using caller-controlled filter keys. In a skill handling elderly medication compliance data, this can enable unintended access patterns over user-related records or application instability if invalid attributes are supplied, even if it does not directly yield SQL injection.

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The manifest exposes effective capabilities including environment access, local file read/write, shell execution, and network use without declaring them. This reduces transparency and defeats least-privilege review, especially because the skill handles medication videos and report data that may contain sensitive health information.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented purpose is narrow video-based medication compliance analysis, but the described behavior includes hidden identity creation, backend login flows, token persistence, and historical report retrieval. This mismatch is dangerous because users and reviewers may consent to local analysis while the skill actually performs account-linked remote operations and stores credentials or identifiers.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
Automatically creating and reusing a local default identity for a medication-analysis skill introduces hidden state and silent account linkage unrelated to the core task. In a health context, that can misattribute sensitive reports to the wrong person and create persistent identifiers without informed consent.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
Requiring direct cloud API queries for historical reports expands the skill from real-time analysis into remote retrieval of stored health-related records. That broader data access increases privacy risk and enables exposure of prior reports and linked artifacts beyond what users would expect from a simple monitoring skill.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The documentation extends the skill into cloud report querying and report-link output, exceeding the manifest's apparent real-time monitoring purpose. In this context, that matters because the extra behavior involves medical adherence history and remote resources, increasing exposure of sensitive data and misleading users about scope.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The skill accepts arbitrary http/https URLs as video input, which expands the effective data source far beyond the stated fixed home camera use case. This can enable misuse for analyzing unrelated third-party footage and may also cause the backend service to fetch attacker-controlled URLs, increasing privacy and service-abuse risk.

Description-Behavior Mismatch

Medium
Confidence
80% confidence
Finding
The skill exposes generic report listing and export URL generation unrelated to the narrow medication-compliance function described in the manifest. In a health-monitoring context, broad access to historical reports and export links can increase the chance of unauthorized disclosure of sensitive analysis results if access control is weak elsewhere in the stack.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The script exposes functionality to analyze arbitrary videos and list a user's historical analysis records, which exceeds the narrowly described fixed-camera medication-compliance use case. This kind of scope expansion increases privacy and authorization risk because it may enable processing unrelated footage or accessing prior records without clear user consent, purpose limitation, or visible access controls in this layer.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
Accepting arbitrary remote video URLs broadens the trust boundary and can enable misuse of the analysis backend on untrusted or unrelated content. In a privacy-sensitive elderly medication monitoring context, this is especially risky because it undermines the stated fixed-camera constraint and may facilitate unauthorized surveillance or backend abuse if server-side fetching is performed downstream.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
This utility automatically provisions or rehydrates user identities and tokens, including calling an external health login endpoint and persisting returned authentication material locally. That behavior is unrelated to the stated medication-compliance camera analysis purpose and creates an undisclosed identity/authentication side channel that could transmit or retain sensitive user data without informed consent.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The code inspects workspace layout, environment variables, and reads a local data file to derive identity values used later for API access. For a skill described as medication-process monitoring, this hidden collection of workspace and identity context expands access beyond functional need and can facilitate tracking, impersonation, or unintended reuse of local credentials.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
This shared utility performs broad filesystem manipulation, agent/workspace discovery, default identity generation, token handling, and generic HTTP orchestration that substantially exceed the manifest's camera-based compliance analysis description. Such overbroad capability increases attack surface and makes it easier for the skill to access local state or communicate externally in ways users would not reasonably expect.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The trigger phrases for historical report retrieval are broad enough to cause automatic invocation from casual or ambiguous user language. Because the retrieved content concerns medication adherence history, unintended triggering could disclose sensitive health information or cause unnecessary remote API access.

Missing User Warnings

High
Confidence
95% confidence
Finding
The skill appears to transmit medication videos and related report data to a cloud/API service without clear up-front warning in the primary description. This is especially dangerous because the input contains highly sensitive health and behavioral data about elderly individuals, creating significant privacy and compliance risk.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The documentation specifies 24-hour continuous camera collection and includes snapshot URLs and alerting about an elderly person's medication behavior, but provides no mention of consent, retention limits, access controls, minimization, or privacy notice requirements. In this context, the system processes highly sensitive health-adjacent behavioral data inside a private home, so omission of privacy safeguards materially increases the risk of surveillance abuse, unauthorized disclosure, and noncompliance with privacy regulations.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The script initializes and potentially switches internal identity context via a hidden `--open-id` parameter that is suppressed from help output, reducing user awareness and scrutiny. In a medication-monitoring skill tied to sensitive health behavior, hidden identity resolution can enable unauthorized access to another person's analysis history or actions if downstream authorization is weak or absent.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
This code transmits either full local file contents or a remote video URL to an analysis service without any user-facing consent, warning, or confirmation step in this path. Because the skill processes elderly medication behavior from home video, silent submission creates meaningful privacy and compliance risk, especially for sensitive health-related footage.

Missing User Warnings

Medium
Confidence
80% confidence
Finding
The hidden --api-key parameter indicates credential handling that is intentionally not disclosed in normal help output, reducing transparency around how authentication secrets are supplied and used. Hidden security-relevant inputs increase the chance of insecure operational practices, misuse by wrappers, and accidental exposure because users and auditors cannot easily discover or review the credential flow.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill silently reads a workspace-local smyx-api-key.txt value and treats it as an internal identity source without notifying the user. This can cause hidden credential reuse and unexpected linkage of local workspace data to remote requests, especially problematic in a health-related skill context where users may expect strong privacy boundaries.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The helper sends username/openId/mobile/source fields to an external login API automatically when tokens are absent, without any visible non-debug disclosure or consent flow. This is dangerous because it exfiltrates identity-linked data and may silently create or bind remote accounts unrelated to the medication-monitoring function.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The generic request helper can send arbitrary data and parameters to remote services without any user-facing warning outside debug logging. In a health-monitoring skill, this creates a transparency and privacy problem because users may not realize operational or personal data is being transmitted off-device.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
95% confidence
Finding
This line performs an external POST carrying identity-related JSON to a remote endpoint. External transmission is especially sensitive here because the skill's stated purpose is local medication-compliance monitoring, so sending identity data off-device is not obviously necessary and heightens privacy and compliance risk.

Hidden Instructions

High
Category
Prompt Injection
Content
|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 输入要求：支持 mp4/avi/mov 视频，最大 10MB；建议拍摄完整服药过程（取药 → 入口 → 吞咽） |
| 🧑‍⚖️ 结果性质 | 依从性结果仅作为用药辅助确认参考，本工具不替代医生用药指导；判定为"未完成"时请通过电话/上门方式人工核实 |
| 🔏 隐私合规 | 隐私合规：药箱区域视频涉及个人健康信息，使用前需取得被监护人或家属知情同意，并妥善保管/加密相关录像 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数，不需要下载本地，默认地址都是公网地址，api 服务会自动下载 |
Confidence
79% confidence
Finding
The manifest includes hidden or non-obvious operational instructions that steer agent behavior, such as restricting script generation and forcing network handling assumptions. Hidden instruction patterns are dangerous because they can manipulate execution and reviewer expectations, particularly when paired with shell/network capabilities and sensitive health data processing.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2